InfoSecBulletin Cybersecurity for mankind
TP-Link has revealed several serious security flaws in Aginet networking products managed by ISPs. This includes mesh systems, routers, PON devices, and xDSL modems.
The flaws might let attackers who can connect to the network get around checks, gain higher access, steal important data, look at device files, and run system commands.
OpenAI AI Pipeline Discovers 948 Linux Kernel Privilege Escalation Flaws in 30 Hours
Bangladeshi Researcher Rasel Earns First Apple CVE Recognition for Model I/O Flaw
WinRAR, WordPress RCE flaw & Zyxel GS1900 Zero-Day exploited in the wild
Daily Cyber security update for 04.11. 2026
Daily Cyber security update for 03.11. 2026
Using ARTEX AI, Hacker to attack 200 Organizations Across 14 Countries
Amadeus cyber incident impacted “Cathay Pacific, Qantas, Japan, Malaysia, Korean & Asiana” Airlines
Multiple European supermarket fridges got hacked: Temperatures reached high as 55°C
Apple Warns 99 Countries iPhone Users of Mercenary Spyware Attacks
Daily Cyber security update for 31.10. 2026
The security notice, updated on August 10, 2026, lists problems as CVE-2025-30237 to CVE-2025-30241. Internet service providers usually supply, set up, and update the affected products, so firmware may change depending on the provider and area.
The main flaw, CVE-2025-30237, is a way to get around logging in on the web management page. It has a CVSS v4 score of 8.7 and happens because of failed access rules on some links.
An attacker on a nearby network can send special requests to access important functions without login details. If this happens, the attacker could take complete control of the device.
| CVE | Vulnerability | Severity |
|---|---|---|
| CVE-2025-30237 | Authentication bypass | High |
| CVE-2025-30238 | Privilege escalation | High |
| CVE-2025-30239 | Sensitive data exposure | High |
| CVE-2025-30240 | Arbitrary file read | Medium |
| CVE-2025-30241 | OS command injection | High |
Multiple TP-Link Flaws
CVE-2025-30238, rated 8.6, is a mistake in user-management that lets low-level users do admin tasks. This means they might create special accounts or change important settings. An attacker with little access could gain more control over a router or mesh node.
Another high-severity issue, CVE-2025-30239, involves hardcoded cryptographic keys stored in firmware. The vulnerability has a CVSS score of 8.5.
An attacker with access to the device’s storage could recover the embedded keys and decrypt protected configuration data. Exposed information may include credentials and ISP-related service settings, creating a risk of further compromise.
CVE-2025-30240 is a medium-severity arbitrary file-read issue with a CVSS score of 5.1. The flaw affects the USB HTTPS access path and stems from improper handling of symbolic links on external USB storage.
A person who can physically reach the device might make a harmful symbolic link on a supported device and use it to get to important files in the router’s system.
The last flaw, CVE-2025-30241, is a serious flaw that lets attackers run commands on the OS. It has a high danger level of 8.6. This happens because some web parts do not check user input correctly before sending it to system commands.
An attacker on the local network could send commands and run them with higher access, possibly gaining full control of the device. The affected devices are from TP-Link’s HB, HX, HC, EB, EC, EX, XC, XX, and VX series.
HB810, HB710, EX220, EX222, EX920, EC220-G5, XX530v, and VX1800v are some examples. The effect varies based on the model for the area, hardware type, ISP changes, and the firmware installed.
TP-Link said that fixing ISP-managed devices will be done with the help of service providers. Often, updates can be installed automatically using ISP management tools.
Users need to look at the router’s admin page or the provider’s app for firmware updates. If there is no update, customers should reach out to their ISP to see if their device is impacted and when a fix will be available.
Users should limit access to management tools because some problems need local or nearby network access. They should use strong, different passwords for administrators, disable unneeded remote management options, and keep untrusted users away from the local network.
